@camstack/server 1.2.594 → 1.2.596

package/dist/api/core/auth-device-cert.procedures.js

@@ -1,28 +1,33 @@
-import { getUserManagementInternal } from '@camstack/system';
-import { CompleteEnrollmentInputSchema, CompleteEnrollmentResultSchema, DEVICE_CERT_SIGNATURE, DeviceChallengeResultSchema, DeviceCredentialSchema, DeviceEnrollProofSchema, DeviceProofInputSchema, DeviceRefusalSchema, EnrollSelfInputSchema, formatDeviceRevoker, isDefinitiveDeviceRefusal, RenewDeviceCertificateResultSchema, RevokeOwnDeviceCertificateResultSchema, } from '@camstack/types';
-import { TRPCError } from '@trpc/server';
-import { z } from 'zod';
-import { SessionUserGoneError, } from '../../auth/session-mint.js';
-import { protectedProcedure } from '../trpc/trpc.middleware.js';
-import { assertReauthenticated, ReauthTokenInput } from './auth-reauth.procedures.js';
-import { trpcUserError } from '../trpc/user-error.js';
-const DeviceLoginResultSchema = z.discriminatedUnion('ok', [
-    z.object({
-        ok: z.literal(true),
-        token: z.string(),
-        user: z.object({ id: z.string(), username: z.string(), isAdmin: z.boolean() }),
-        expiresAt: z.number().optional(),
-        sessionId: z.string().optional(),
-        sessionExpiresAt: z.number().optional(),
-        refreshToken: z.string().optional(),
-        credentialId: z.string(),
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toWireReason = toWireReason;
+exports.refusal = refusal;
+exports.createDeviceCertProcedures = createDeviceCertProcedures;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const session_mint_js_1 = require("../../auth/session-mint.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const user_error_js_1 = require("../trpc/user-error.js");
+const DeviceLoginResultSchema = zod_1.z.discriminatedUnion('ok', [
+    zod_1.z.object({
+        ok: zod_1.z.literal(true),
+        token: zod_1.z.string(),
+        user: zod_1.z.object({ id: zod_1.z.string(), username: zod_1.z.string(), isAdmin: zod_1.z.boolean() }),
+        expiresAt: zod_1.z.number().optional(),
+        sessionId: zod_1.z.string().optional(),
+        sessionExpiresAt: zod_1.z.number().optional(),
+        refreshToken: zod_1.z.string().optional(),
+        credentialId: zod_1.z.string(),
         /** The certificate's expiry (epoch ms): the app renews when < 30 days remain. */
-        certNotAfter: z.number(),
+        certNotAfter: zod_1.z.number(),
     }),
-    DeviceRefusalSchema,
+    types_1.DeviceRefusalSchema,
 ]);
 /** Internal manager reason → the wire reason an app switches on. */
-export function toWireReason(reason) {
+function toWireReason(reason) {
     switch (reason) {
         case 'revoked':
         case 'unknown-credential':
@@ -53,11 +58,11 @@ export function toWireReason(reason) {
             return 'superseded';
     }
 }
-export function refusal(reason, retryAfterSeconds) {
+function refusal(reason, retryAfterSeconds) {
     return {
         ok: false,
         reason,
-        definitive: isDefinitiveDeviceRefusal(reason),
+        definitive: (0, types_1.isDefinitiveDeviceRefusal)(reason),
         ...(retryAfterSeconds !== undefined ? { retryAfterSeconds } : {}),
     };
 }
@@ -65,13 +70,13 @@ function fromAddress(req, network) {
     const ip = network.clientAddress(req).ip;
     return ip ?? undefined;
 }
-export function createDeviceCertProcedures(deps) {
+function createDeviceCertProcedures(deps) {
     const internal = () => {
         const found = deps.registry === null
             ? null
-            : getUserManagementInternal(deps.registry.getSingleton('user-management'));
+            : (0, system_1.getUserManagementInternal)(deps.registry.getSingleton('user-management'));
         if (found === null) {
-            throw trpcUserError('PRECONDITION_FAILED', 'device.certificates-unavailable', undefined, 'Device certificates are not available');
+            throw (0, user_error_js_1.trpcUserError)('PRECONDITION_FAILED', 'device.certificates-unavailable', undefined, 'Device certificates are not available');
         }
         return found;
     };
@@ -106,13 +111,13 @@ export function createDeviceCertProcedures(deps) {
     };
     const assertPerson = (user) => {
         if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
-            throw trpcUserError('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
+            throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
         }
     };
     const selfLimit = (userId, path) => {
         const verdict = deps.selfLimiter.check(`${path}:${userId}`);
         if (!verdict.allowed) {
-            throw new TRPCError({
+            throw new server_1.TRPCError({
                 code: 'TOO_MANY_REQUESTS',
                 message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
             });
@@ -121,8 +126,8 @@ export function createDeviceCertProcedures(deps) {
     return {
         /** PUBLIC — redeem a QR enrollment code with the device's PUBLIC key; answers the certificate. */
         completeEnrollment: deps.publicProcedure
-            .input(CompleteEnrollmentInputSchema)
-            .output(CompleteEnrollmentResultSchema)
+            .input(types_1.CompleteEnrollmentInputSchema)
+            .output(types_1.CompleteEnrollmentResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'completeEnrollment', ctx.req);
             if (slow !== null)
@@ -145,8 +150,8 @@ export function createDeviceCertProcedures(deps) {
         }),
         /** PUBLIC — a single-use nonce (60 s), bound to the hub origin this request is entitled to. */
         getDeviceChallenge: deps.publicProcedure
-            .input(z.void())
-            .output(DeviceChallengeResultSchema)
+            .input(zod_1.z.void())
+            .output(types_1.DeviceChallengeResultSchema)
             .mutation(async ({ ctx }) => {
             const slow = limited(deps.ceremonyLimiter, 'getDeviceChallenge', ctx.req);
             if (slow !== null)
@@ -162,7 +167,7 @@ export function createDeviceCertProcedures(deps) {
             if (origin === null)
                 return refusal('unavailable');
             const { nonce, expiresAt } = internal().deviceCredentials.issueNonce(origin, partition);
-            return { ok: true, nonce, origin, expiresAt, signature: DEVICE_CERT_SIGNATURE };
+            return { ok: true, nonce, origin, expiresAt, signature: types_1.DEVICE_CERT_SIGNATURE };
         }),
         /**
          * PUBLIC — sign in with the device certificate: chain to the device CA, not
@@ -170,7 +175,7 @@ export function createDeviceCertProcedures(deps) {
          * Opens the SAME session a password login opens, carrying the credential id.
          */
         loginWithDeviceCertificate: deps.publicProcedure
-            .input(DeviceProofInputSchema.extend({ refreshable: z.boolean().optional() }))
+            .input(types_1.DeviceProofInputSchema.extend({ refreshable: zod_1.z.boolean().optional() }))
             .output(DeviceLoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'loginWithDeviceCertificate', ctx.req);
@@ -215,7 +220,7 @@ export function createDeviceCertProcedures(deps) {
                 };
             }
             catch (error) {
-                if (error instanceof SessionUserGoneError) {
+                if (error instanceof session_mint_js_1.SessionUserGoneError) {
                     deps.logger?.warn('Device certificate login refused: user-gone', {
                         tags: { credentialId: credential.id, userId: credential.userId },
                     });
@@ -226,8 +231,8 @@ export function createDeviceCertProcedures(deps) {
         }),
         /** PUBLIC — a new leaf for the SAME public key, while the certificate is valid and not revoked. */
         renewDeviceCertificate: deps.publicProcedure
-            .input(DeviceProofInputSchema)
-            .output(RenewDeviceCertificateResultSchema)
+            .input(types_1.DeviceProofInputSchema)
+            .output(types_1.RenewDeviceCertificateResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'renewDeviceCertificate', ctx.req);
             if (slow !== null)
@@ -256,8 +261,8 @@ export function createDeviceCertProcedures(deps) {
          * purpose): works with no session. Ends every session the credential opened.
          */
         revokeOwnDeviceCertificate: deps.publicProcedure
-            .input(DeviceProofInputSchema)
-            .output(RevokeOwnDeviceCertificateResultSchema)
+            .input(types_1.DeviceProofInputSchema)
+            .output(types_1.RevokeOwnDeviceCertificateResultSchema)
             .mutation(async ({ input, ctx }) => {
             const slow = limited(deps.credentialLimiter, 'revokeOwnDeviceCertificate', ctx.req);
             if (slow !== null)
@@ -271,7 +276,7 @@ export function createDeviceCertProcedures(deps) {
             if (!checked.ok)
                 return refusal(toWireReason(checked.reason));
             const id = checked.credential.id;
-            await internal().deviceCredentials.revoke(id, formatDeviceRevoker({ kind: 'device' }));
+            await internal().deviceCredentials.revoke(id, (0, types_1.formatDeviceRevoker)({ kind: 'device' }));
             const sessionsEnded = await internal().sessions.revokeByCredential(id);
             await audit('device-credential-revoked', checked.credential.userId, ctx.req, {
                 credentialId: id,
@@ -282,9 +287,9 @@ export function createDeviceCertProcedures(deps) {
         }),
         // ── Signed-in legs ───────────────────────────────────────────────
         /** The caller's own device credentials (live ones, and revoked when asked). */
-        listOwnDeviceCredentials: protectedProcedure
-            .input(z.object({ includeRevoked: z.boolean().optional() }).optional())
-            .output(z.array(DeviceCredentialSchema))
+        listOwnDeviceCredentials: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ includeRevoked: zod_1.z.boolean().optional() }).optional())
+            .output(zod_1.z.array(types_1.DeviceCredentialSchema))
             .query(({ ctx, input }) => {
             assertPerson(ctx.user);
             const manager = internal().deviceCredentials;
@@ -312,9 +317,9 @@ export function createDeviceCertProcedures(deps) {
             }));
         }),
         /** Revoke one of the caller's OWN credentials by id, from a session (e.g. a lost phone). */
-        revokeOwnDeviceCredential: protectedProcedure
-            .input(z.object({ id: z.string().min(1) }))
-            .output(z.object({ revoked: z.boolean(), sessionsEnded: z.number().int() }))
+        revokeOwnDeviceCredential: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ revoked: zod_1.z.boolean(), sessionsEnded: zod_1.z.number().int() }))
             .mutation(async ({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'revokeOwnDeviceCredential');
@@ -326,7 +331,7 @@ export function createDeviceCertProcedures(deps) {
                 });
                 return { revoked: false, sessionsEnded: 0 };
             }
-            const revoked = await internal().deviceCredentials.revoke(input.id, formatDeviceRevoker({ kind: 'user', userId: ctx.user.id }));
+            const revoked = await internal().deviceCredentials.revoke(input.id, (0, types_1.formatDeviceRevoker)({ kind: 'user', userId: ctx.user.id }));
             const sessionsEnded = await internal().sessions.revokeByCredential(input.id);
             if (revoked) {
                 await audit('device-credential-revoked', ctx.user.id, ctx.req, {
@@ -338,16 +343,16 @@ export function createDeviceCertProcedures(deps) {
             return { revoked, sessionsEnded };
         }),
         /** Step-up, password / passkey: turn a fresh `reauthenticate` proof into a single-use device-enroll proof. */
-        deviceEnrollProofFromReauth: protectedProcedure
-            .input(z.object({ reauthToken: ReauthTokenInput }))
-            .output(DeviceEnrollProofSchema)
+        deviceEnrollProofFromReauth: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput }))
+            .output(types_1.DeviceEnrollProofSchema)
             .mutation(({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'deviceEnrollProofFromReauth');
-            assertReauthenticated(deps.auth, ctx.user, input.reauthToken);
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, ctx.user, input.reauthToken);
             // One reauthentication, one proof (or one step-up handoff code).
             if (!deps.enrollProofs.consumeReauth(input.reauthToken)) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'FORBIDDEN',
                     message: 'This re-authentication was already used - confirm it is you again',
                 });
@@ -359,13 +364,13 @@ export function createDeviceCertProcedures(deps) {
          * `code` is a handoff code minted with purpose `step-up` by a browser sign-in
          * of the SAME user. Opens no session and replaces none.
          */
-        deviceEnrollProofFromHandoff: protectedProcedure
-            .input(z.object({
-            code: z.string().min(1).max(256),
-            codeVerifier: z.string().min(1).max(256).optional(),
-            state: z.string().min(1).max(256).optional(),
+        deviceEnrollProofFromHandoff: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({
+            code: zod_1.z.string().min(1).max(256),
+            codeVerifier: zod_1.z.string().min(1).max(256).optional(),
+            state: zod_1.z.string().min(1).max(256).optional(),
         }))
-            .output(DeviceEnrollProofSchema)
+            .output(types_1.DeviceEnrollProofSchema)
             .mutation(({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'deviceEnrollProofFromHandoff');
@@ -381,7 +386,7 @@ export function createDeviceCertProcedures(deps) {
                         reason: reason ?? (grant?.purpose !== 'step-up' ? 'wrong-purpose' : 'other-user'),
                     },
                 });
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'UNAUTHORIZED',
                     message: 'Invalid, expired or mismatched step-up code — sign in again',
                 });
@@ -394,9 +399,9 @@ export function createDeviceCertProcedures(deps) {
          * a merely refreshed session can never mint a permanent credential.
          * Hub-wide `deviceCertificates.selfEnrollment = disabled` refuses.
          */
-        enrollSelf: protectedProcedure
-            .input(EnrollSelfInputSchema)
-            .output(CompleteEnrollmentResultSchema)
+        enrollSelf: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.EnrollSelfInputSchema)
+            .output(types_1.CompleteEnrollmentResultSchema)
             .mutation(async ({ ctx, input }) => {
             assertPerson(ctx.user);
             selfLimit(ctx.user.id, 'enrollSelf');

package/dist/api/core/auth-limits.js

@@ -1,3 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROCESS_AUTH_LIMITERS = void 0;
+exports.createAuthLimiters = createAuthLimiters;
+exports.tooMany = tooMany;
+exports.limitByClient = limitByClient;
+exports.assertAccountNotLocked = assertAccountNotLocked;
+exports.recordAccountFailure = recordAccountFailure;
+exports.limitByUser = limitByUser;
 /**
  * Rate limits of the public auth surface, in one place.
  *
@@ -20,29 +29,29 @@
  *
  * Mesh-internal calls (no originating request) are never limited.
  */
-import { TRPCError } from '@trpc/server';
-import { DEFAULT_AUTH_NETWORK_POLICY, } from '../../auth/auth-network-policy.js';
-import { createRateLimiter } from '../../auth/auth-rate-limit.js';
-export function createAuthLimiters(now) {
+const server_1 = require("@trpc/server");
+const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+function createAuthLimiters(now) {
     const clock = now !== undefined ? { now } : {};
     return {
-        credential: createRateLimiter({ windowMs: 60_000, max: 10, ...clock }),
-        ceremony: createRateLimiter({ windowMs: 60_000, max: 30, ...clock }),
-        accountFailures: createRateLimiter({ windowMs: 15 * 60_000, max: 20, ...clock }),
-        link: createRateLimiter({ windowMs: 60_000, max: 5, ...clock }),
-        reauth: createRateLimiter({ windowMs: 60_000, max: 10, ...clock }),
+        credential: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10, ...clock }),
+        ceremony: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 30, ...clock }),
+        accountFailures: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 15 * 60_000, max: 20, ...clock }),
+        link: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 5, ...clock }),
+        reauth: (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10, ...clock }),
     };
 }
 /** The process-wide limiters: router rebuilds must not reset an attacker's budget. */
-export const PROCESS_AUTH_LIMITERS = createAuthLimiters();
-export function tooMany(retryAfterSeconds) {
-    return new TRPCError({
+exports.PROCESS_AUTH_LIMITERS = createAuthLimiters();
+function tooMany(retryAfterSeconds) {
+    return new server_1.TRPCError({
         code: 'TOO_MANY_REQUESTS',
         message: `Too many attempts — retry in ${retryAfterSeconds}s`,
     });
 }
 /** Count one attempt from the request's client address; throws when over. */
-export function limitByClient(limiter, bucket, req, network = DEFAULT_AUTH_NETWORK_POLICY) {
+function limitByClient(limiter, bucket, req, network = auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY) {
     const ip = network.clientAddress(req).ip;
     if (ip === null)
         return;
@@ -51,17 +60,17 @@ export function limitByClient(limiter, bucket, req, network = DEFAULT_AUTH_NETWO
         throw tooMany(verdict.retryAfterSeconds);
 }
 /** Refuse before checking a secret when `account` already failed too often. */
-export function assertAccountNotLocked(limiters, account) {
+function assertAccountNotLocked(limiters, account) {
     const verdict = limiters.accountFailures.peek(`account:${account.toLowerCase()}`);
     if (!verdict.allowed)
         throw tooMany(verdict.retryAfterSeconds);
 }
 /** Count one failed secret against `account`. */
-export function recordAccountFailure(limiters, account) {
+function recordAccountFailure(limiters, account) {
     limiters.accountFailures.check(`account:${account.toLowerCase()}`);
 }
 /** Count one call of an authenticated leg against the user; throws when over. */
-export function limitByUser(limiter, bucket, userId) {
+function limitByUser(limiter, bucket, userId) {
     const verdict = limiter.check(`${bucket}:${userId}`);
     if (!verdict.allowed)
         throw tooMany(verdict.retryAfterSeconds);

package/dist/api/core/auth-reauth.procedures.js

@@ -1,23 +1,28 @@
-import { TRPCError } from '@trpc/server';
-import { z } from 'zod';
-import { OptionsJsonSchema, resolvePasskeyProvider } from '../../auth/passkey-provider.js';
-import { protectedProcedure } from '../trpc/trpc.middleware.js';
-import { assertAccountNotLocked, limitByUser, recordAccountFailure, } from './auth-limits.js';
-import { trpcUserError } from '../trpc/user-error.js';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REAUTH_REQUIRED_MESSAGE = exports.ReauthTokenInput = void 0;
+exports.assertReauthenticated = assertReauthenticated;
+exports.createReauthProcedures = createReauthProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_limits_js_1 = require("./auth-limits.js");
+const user_error_js_1 = require("../trpc/user-error.js");
 /** The input field a re-auth-gated procedure takes. */
-export const ReauthTokenInput = z.string().min(1).max(4096);
-export const REAUTH_REQUIRED_MESSAGE = 'Confirm it is you first: re-enter your password or use a passkey (update the app if it cannot ask).';
+exports.ReauthTokenInput = zod_1.z.string().min(1).max(4096);
+exports.REAUTH_REQUIRED_MESSAGE = 'Confirm it is you first: re-enter your password or use a passkey (update the app if it cannot ask).';
 /**
  * Throw unless `reauthToken` is a live proof by THIS user, made in THIS
  * session. A missing token is the same refusal: the action needs one.
  */
-export function assertReauthenticated(auth, user, reauthToken) {
+function assertReauthenticated(auth, user, reauthToken) {
     const claims = reauthToken === undefined ? null : auth.verifyReauthToken(reauthToken);
     const valid = claims !== null &&
         claims.userId === user.id &&
         (user.sessionId === undefined || claims.sessionId === user.sessionId);
     if (!valid)
-        throw new TRPCError({ code: 'FORBIDDEN', message: REAUTH_REQUIRED_MESSAGE });
+        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: exports.REAUTH_REQUIRED_MESSAGE });
 }
 function isPasswordChecker(value) {
     return (value !== null &&
@@ -27,19 +32,19 @@ function isPasswordChecker(value) {
 /** Real user sessions only: a scoped or share token cannot prove a password. */
 function assertPerson(user) {
     if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
-        throw trpcUserError('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
+        throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.session-required', undefined, 'Requires a signed-in user session');
     }
 }
-export function createReauthProcedures(deps) {
+function createReauthProcedures(deps) {
     return {
         /** Passkey re-authentication, step 1: assertion options for the caller's own credentials. */
-        reauthBeginPasskey: protectedProcedure
-            .input(z.void())
-            .output(OptionsJsonSchema)
+        reauthBeginPasskey: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(passkey_provider_js_1.OptionsJsonSchema)
             .mutation(async ({ ctx }) => {
             assertPerson(ctx.user);
-            limitByUser(deps.limiters.reauth, 'auth.reauthBeginPasskey', ctx.user.id);
-            const provider = resolvePasskeyProvider(deps.registry, deps.moleculer);
+            (0, auth_limits_js_1.limitByUser)(deps.limiters.reauth, 'auth.reauthBeginPasskey', ctx.user.id);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(deps.registry, deps.moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginAuthentication({ userId: ctx.user.id });
@@ -49,20 +54,20 @@ export function createReauthProcedures(deps) {
          * `reauthBeginPasskey`. Answers a 5-minute proof for the re-auth-gated
          * actions, valid only for this user in this session.
          */
-        reauthenticate: protectedProcedure
-            .input(z.union([
-            z.object({ password: z.string().min(1).max(1024) }),
-            z.object({ passkeyResponse: z.record(z.string(), z.unknown()) }),
+        reauthenticate: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.union([
+            zod_1.z.object({ password: zod_1.z.string().min(1).max(1024) }),
+            zod_1.z.object({ passkeyResponse: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }),
         ]))
-            .output(z.object({
-            reauthToken: z.string(),
-            expiresAt: z.number(),
-            method: z.enum(['password', 'passkey']),
+            .output(zod_1.z.object({
+            reauthToken: zod_1.z.string(),
+            expiresAt: zod_1.z.number(),
+            method: zod_1.z.enum(['password', 'passkey']),
         }))
             .mutation(async ({ ctx, input }) => {
             assertPerson(ctx.user);
-            limitByUser(deps.limiters.reauth, 'auth.reauthenticate', ctx.user.id);
-            assertAccountNotLocked(deps.limiters, ctx.user.username);
+            (0, auth_limits_js_1.limitByUser)(deps.limiters.reauth, 'auth.reauthenticate', ctx.user.id);
+            (0, auth_limits_js_1.assertAccountNotLocked)(deps.limiters, ctx.user.username);
             let method;
             if ('password' in input) {
                 const userMgmt = deps.registry?.getSingleton('user-management');
@@ -74,13 +79,13 @@ export function createReauthProcedures(deps) {
                     password: input.password,
                 });
                 if (record === null || record.id !== ctx.user.id) {
-                    recordAccountFailure(deps.limiters, ctx.user.username);
-                    throw trpcUserError('UNAUTHORIZED', 'auth.password-incorrect', undefined, 'Password is incorrect');
+                    (0, auth_limits_js_1.recordAccountFailure)(deps.limiters, ctx.user.username);
+                    throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.password-incorrect', undefined, 'Password is incorrect');
                 }
                 method = 'password';
             }
             else {
-                const provider = resolvePasskeyProvider(deps.registry, deps.moleculer);
+                const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(deps.registry, deps.moleculer);
                 if (!provider)
                     throw new Error('Passkey authentication is not available');
                 const result = await provider.finishAuthentication({
@@ -88,8 +93,8 @@ export function createReauthProcedures(deps) {
                     response: input.passkeyResponse,
                 });
                 if (!result.verified) {
-                    recordAccountFailure(deps.limiters, ctx.user.username);
-                    throw trpcUserError('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
+                    (0, auth_limits_js_1.recordAccountFailure)(deps.limiters, ctx.user.username);
+                    throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
                 }
                 method = 'passkey';
             }

package/dist/api/core/auth-revoke-credentials.procedures.js

@@ -1,32 +1,36 @@
-import { TRPCError } from '@trpc/server';
-import { z } from 'zod';
-import { userManagementInternal } from '../../auth/hub-sessions.js';
-import { adminProcedure } from '../trpc/trpc.middleware.js';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevokeSkipReasonSchema = exports.RevocableCredentialKindSchema = exports.REVOKE_CREDENTIALS_MAX = void 0;
+exports.createRevokeCredentialsProcedures = createRevokeCredentialsProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 /** Upper bound of one bulk call — a page of a table, several times over. */
-export const REVOKE_CREDENTIALS_MAX = 500;
+exports.REVOKE_CREDENTIALS_MAX = 500;
 /** What a bulk revoke can target. Each has a per-row revoke on the server. */
-export const RevocableCredentialKindSchema = z.enum([
+exports.RevocableCredentialKindSchema = zod_1.z.enum([
     'share-link',
     'admin-token',
     'login-session',
     'scoped-token',
     'oauth-session',
 ]);
-export const RevokeSkipReasonSchema = z.enum(['current-session', 'not-active']);
-const RevokeCredentialsInputSchema = z
+exports.RevokeSkipReasonSchema = zod_1.z.enum(['current-session', 'not-active']);
+const RevokeCredentialsInputSchema = zod_1.z
     .object({
-    kind: RevocableCredentialKindSchema,
-    ids: z.array(z.string().min(1)).min(1).max(REVOKE_CREDENTIALS_MAX),
+    kind: exports.RevocableCredentialKindSchema,
+    ids: zod_1.z.array(zod_1.z.string().min(1)).min(1).max(exports.REVOKE_CREDENTIALS_MAX),
     /** The count the operator confirmed. Must equal `ids.length`. */
-    confirmCount: z.number().int().min(1),
+    confirmCount: zod_1.z.number().int().min(1),
 })
     .refine((input) => new Set(input.ids).size === input.ids.length, {
     message: 'Each id may be listed once',
     path: ['ids'],
 });
-const RevokeCredentialsOutputSchema = z.object({
-    revoked: z.array(z.string()),
-    skipped: z.array(z.object({ id: z.string(), reason: RevokeSkipReasonSchema })),
+const RevokeCredentialsOutputSchema = zod_1.z.object({
+    revoked: zod_1.z.array(zod_1.z.string()),
+    skipped: zod_1.z.array(zod_1.z.object({ id: zod_1.z.string(), reason: exports.RevokeSkipReasonSchema })),
 });
 /** Keep the audit row bounded; the ids beyond this are counted, not listed. */
 const AUDIT_IDS_MAX_CHARS = 4000;
@@ -35,16 +39,16 @@ function assertSignedInAdminSession(user) {
         user.shareView !== undefined ||
         user.credential !== undefined ||
         user.adminTokenId !== undefined) {
-        throw new TRPCError({
+        throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: 'Revoking credentials in bulk needs a signed-in admin session',
         });
     }
 }
 function requireInternal(registry) {
-    const internal = registry === null ? null : userManagementInternal(registry);
+    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
     if (internal === null) {
-        throw new TRPCError({
+        throw new server_1.TRPCError({
             code: 'PRECONDITION_FAILED',
             message: 'User management is not available',
         });
@@ -56,7 +60,7 @@ function revokerFor(kind, caller, deps) {
     if (kind === 'share-link') {
         const service = deps.shareTokens;
         if (service === null) {
-            throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Share links are not available' });
+            throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Share links are not available' });
         }
         return async (id) => (await service.revoke({ id, callerUserId: caller.id, callerIsAdmin: true }))
             ? null
@@ -84,16 +88,16 @@ function auditIds(ids) {
     const joined = ids.join(',');
     return joined.length <= AUDIT_IDS_MAX_CHARS ? joined : `${joined.slice(0, AUDIT_IDS_MAX_CHARS)}…`;
 }
-export function createRevokeCredentialsProcedures(deps) {
+function createRevokeCredentialsProcedures(deps) {
     return {
         /** ADMIN — revoke exactly `ids` of one kind; see the module header. */
-        revokeCredentials: adminProcedure
+        revokeCredentials: trpc_middleware_js_1.adminProcedure
             .input(RevokeCredentialsInputSchema)
             .output(RevokeCredentialsOutputSchema)
             .mutation(async ({ ctx, input }) => {
             assertSignedInAdminSession(ctx.user);
             if (input.confirmCount !== input.ids.length) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'BAD_REQUEST',
                     message: `Confirmed ${input.confirmCount} but ${input.ids.length} were listed — nothing was revoked`,
                 });
@@ -110,7 +114,7 @@ export function createRevokeCredentialsProcedures(deps) {
                 else
                     skipped.push({ id, reason });
             }
-            const internal = deps.registry === null ? null : userManagementInternal(deps.registry);
+            const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
             if (internal !== null) {
                 const ip = deps.network.clientAddress(ctx.req).ip;
                 await internal.audit.record({